From ae25974de301ba1809f2d7f0219fcdd86d18cc1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= <l.s.r@web.de>
Date: Fri, 15 Jul 2022 05:58:50 +0200
Subject: [PATCH] mingw: avoid mktemp() in mkstemp() implementation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The implementation of mkstemp() for MinGW uses mktemp() and open()
without the flag O_EXCL, which is racy.  It's not a security problem
for now because all of its callers only create files within the
repository (incl. worktrees).  Replace it with a call to our more
secure internal function, git_mkstemp_mode(), to prevent possible
future issues.

Signed-off-by: René Scharfe <l.s.r@web.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
---
 compat/mingw.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/compat/mingw.c b/compat/mingw.c
index 41fc16310c..e92087acc6 100644
--- a/compat/mingw.c
+++ b/compat/mingw.c
@@ -1044,10 +1044,7 @@ char *mingw_mktemp(char *template)
 
 int mkstemp(char *template)
 {
-	char *filename = mktemp(template);
-	if (filename == NULL)
-		return -1;
-	return open(filename, O_RDWR | O_CREAT, 0600);
+	return git_mkstemp_mode(template, 0600);
 }
 
 int gettimeofday(struct timeval *tv, void *tz)